Privacy

LAST UPDATED 2 OCTOBER 2026

Anno's camera works entirely on your iPhone. Nothing you shoot with it leaves your phone. The one exception is Travel, an optional paid feature: when you choose to travel a photo, that photo is sent to be remade by AI. This page says exactly what happens to it.

Anno is made by Rushi Mistry in Ahmedabad, India, who is responsible for the data described here. Contact details are at the end of this page.

Travel arrives in Anno 1.1. If you are using an earlier version, it has no Travel and no upload of any kind: only the camera section below applies to you.

The camera: nothing leaves your phone

Anno reads camera frames and any photo you choose from your library, renders them on your device using your iPhone's graphics hardware, and shows you the result. Images exist only in memory until you tap Save, at which point they are written to your own photo library.

Taking, grading, framing, date-stamping and saving photos and videos never uploads, transmits or shares anything.

Travel: what is sent, and where

Travel is optional. It only runs when you pick a photo, agree to the explanation shown before your first travel, and choose a decade. Then:

• On your phone first. Anno checks the photo for a face using Apple's on-device face detection, and crops it. Face detection is used only to check and crop the photo. It is never stored, sent on its own, or used to identify anyone, for advertising, or for analysis of any kind.
• To Anno's server. The cropped photo is sent over an encrypted connection to Anno's server, which runs on Cloudflare. The server passes it to Google and does not store your original photo.
• To Google. Google's Gemini image model makes the new picture. Under Google's paid Gemini API terms, Google does not use your photo or the result to train or improve its models, and keeps both for up to 55 days solely to detect and prevent abuse, before deleting them.
• Back to you. The finished picture is sent back to your phone. Anno's server keeps a copy for 7 days, so it can be downloaded again if your connection drops, and then deletes it automatically.

Pictures made by Google's model carry Google's invisible SynthID watermark and a Content Credentials label in the file, both of which identify the picture as made by AI. Anno does not remove them.

Only use Travel on photos of yourself, or of people who have agreed. You must be 18 or older to use Travel.

What Anno's server keeps, and for how long

• Your original photo: not kept. It is passed to Google and discarded.
• The finished picture: 7 days, then deleted automatically.
• A random device identifier created by the app, shown in Settings as your Travel ID. It is not your name, email, Apple ID or phone number. Kept until you ask for it to be deleted.
• Your credit balance, and a record of each change to it: credits bought, spent or refunded. Kept until you ask for it to be deleted.
• Purchase records from Apple: which pack, when, and Apple's transaction number. Anno never sees your name, card or payment details; Apple handles payment. Kept until you ask for them to be deleted, except where the law requires records of sales to be kept.
• A log of travels: the decade, whether it worked, how long it took and when. No images, and nothing about what is in them. Kept for 90 days, then deleted automatically.
• An App Attest key from Apple, which proves requests come from the genuine Anno app on a real iPhone. It identifies the app installation, not you.
• A notification token, only if you turn on "Tell me when there's something new" in Settings. It is Apple's token for your phone, kept so a notice can reach you, and deleted the moment you turn the setting off. Notices are written by hand and are never based on what you photograph or travel.
• An invite code, if you ask for one or use a friend's. The code is tied to your Travel ID so a free travel can be given to both sides, once. No names, no contacts and no address book are involved.

Anno's server does not record your IP address or location. Cloudflare, which carries the connection, necessarily sees your IP address in order to deliver it, under its own privacy policy.

Clothes and streets belong to a place, so the server reads the country your connection arrives from, which Cloudflare works out from that IP address, and uses it to choose which country's clothing, streets and vehicles the decade is drawn with. It is used for that one choice as the request passes through, and is never written down. Anno never asks your phone for your location, and a country Anno has no set for is drawn without naming any country at all.

Anno's server and Google's systems may process your photo outside India.

Your Travel ID is kept in your iPhone's keychain and in iCloud's key-value storage, so the credits you have paid for survive deleting the app and follow you to a new iPhone. It is a random identifier and nothing else: it is stored in your own iCloud account, where Anno cannot read anything else.

Changing your mind, and deleting your data

• Withdraw permission at any time in Settings, under Travel. Anno then asks again before sending any photo, and sends nothing until you agree.
• Delete your Travel data by emailing the address below with your Travel ID, from Settings. Your device record, credit history, purchase records and travel log are deleted, except where the law requires records of sales to be kept. Deleting your data also removes any unused credits.
• Ask what is held about your Travel ID, or have it corrected, the same way.

The darkroom

Photos you save, and pictures made by Travel, are also kept in the darkroom inside Anno, in the app's own storage on your phone. Anno does not upload or back them up, and they are removed when you delete the app.

Permissions

• Camera. Required to show and grade a live preview, and to take photos and videos. Frames are never recorded unless you press the shutter.
• Photos, add only. Used to save what you make. Anno can write to your library but cannot read it.
• Photo picker. When you choose an existing photo, iOS hands Anno only that image. Anno cannot browse your library.

You can withdraw any permission at any time in iOS Settings. Anno continues to work with reduced functionality.

Date stamp and RAW files

The date stamp is drawn into the image on your device, in the style of the decade you chose. It uses your iPhone's clock and nothing else. Anno never asks for your location and adds none to anything it saves.

If you turn on Save RAW, Anno writes a second, unprocessed file of the same shot to your photo library. Like every other image from the camera, it stays on your device.

Settings

Your preferences are stored locally on your device and are removed when you delete the app.

Third parties

Anno contains no advertising, no tracking and no analytics, and does not sell or share your data. The only services involved are the ones Travel needs:

• Cloudflare runs Anno's server and storage. Cloudflare's privacy policy.
• Google makes the pictures, under its paid Gemini API terms. Gemini API terms.
• Apple handles purchases and App Attest. Apple's privacy policy.

Each uses your data only to provide that service to Anno, under terms that protect it at least as strongly as this policy.

Age

Anno is rated 18+ on the App Store. Travel must not be used by anyone under 18, and Anno does not knowingly collect information from children.

Changes

If this policy changes, this page will be updated and the change described in What's new inside the app. Anno will ask for your permission again before Travel sends anything under new terms.

Contact

Questions about privacy, or to have your data deleted: mistryrushi007@gmail.com